Procedure examples

OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

OilRig has used PowerShell to upload files from compromised systems.

OilRig has used sc query on a victim to gather information about services.

OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.

OilRig has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.

OilRig has run ipconfig /all on a victim.

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.

OilRig has used Putty to access compromised systems.

OilRig has used Wireshark’s usbcapcmd utility to capture USB traffic.

OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.

OilRig has encrypted and encoded data in its malware, including by using base64.

OilRig has run whoami on a victim.

OilRig has used .doc file extensions to mask malicious executables.

OilRig has named a downloaded copy of the Plink tunneling utility as \ProgramData\Adobe.exe.

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.

OilRig has used WMI for execution.

OilRig has exfiltrated data via Microsoft Exchange and over FTP separately from its primary C2 channel over DNS.

OilRig has used netstat -an on a victim to get a listing of network connections.

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.

OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.

OilRig has run tasklist on a victim's machine and used infostealers to capture processes.

OilRig has used various types of scripting for execution.

OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.

OilRig has used VBScript macros for execution on compromised hosts.

OilRig has exploited the Windows Kernel Elevation of Privilege vulnerability, CVE-2024-30088.

OilRig has used net localgroup administrators to find local administrators on compromised systems.

OilRig has used net group /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings.

OilRig has deleted files associated with their payload after execution.

OilRig has used HTTP for C2.

OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.

OilRig has used compromised credentials to access other systems on a victim network.

OilRig has used an exfiltration tool named STEALHOOK to retreive valid domain credentials.

OilRig has run hostname and systeminfo on a victim.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

OilRig had downloaded remote files onto victim infrastructure.

OilRig has used brute force techniques to obtain credentials.

OilRig has used reg.exe to modify system configuration.

OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.

OilRig has used infostealer tools to copy clipboard data.

OilRig has used automated collection.

OilRig has used tools to identify if a mouse is connected to a targeted system.

OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.

OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.

OilRig has leveraged compromised organizations to conduct supply chain attacks on government entities.

OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.